Dutch police and prosecutors face a triple threat: deepfakes, hacked surveillance cameras, and a new generation of cybercriminals

Dutch authorities are grappling with three distinct but interconnected cybercrime challenges this week: the prosecution of a 74-year-old man for creating deepfake pornography of dozens of well-known Dutch women, a breach of a Flock Safety surveillance camera that exposed its tracking capabilities, and a broader shift in the cybercriminal landscape toward younger, Western offenders.

Deepfake prosecution moves forward

The Openbaar Ministerie (OM) confirmed on September 20 that it will prosecute a 74-year-old man from North Holland for producing and distributing deepfake pornographic videos of prominent Dutch women, including politicians, Olympic athletes, TV presenters, and members of the royal family. The case dates back to March 2024, when the videos appeared on a website with 13 million monthly visitors. The site has since been taken offline.

Tens of women filed complaints. BBB leader Caroline van der Plas described the experience as "digital rape," while presenter Hélène Hendriks and others publicly urged prosecution. The OM decided to bring charges after a year-long investigation. The suspect faces up to two years in prison.

The Canadian who ran the website will not be prosecuted because his actions were not illegal in Canada, and the OM said extraditing him would require too much police capacity. Source: NOS

Flock camera breach reveals surveillance scope

In a separate incident, hackers physically removed a Flock Safety automatic license plate reader from a pole, copied its storage, and recovered an encryption key stored on the device. They shared the data with 404 Media, WIRED, and the transparency nonprofit Distributed Denial of Secrets.

Analysis of the recovered files shows the camera's software explicitly detects people, vehicles, license plates, and bicycles. Over several weeks, the camera generated more than 1.6 million images. The computer-vision system also isolated bumper stickers and other graphics. While much of the most sensitive storage remained encrypted, the breach reveals that Flock's claims of on-device encryption do not fully protect against physical compromise. Source: Ars Technica

A new generation of cybercriminals

The Dutch police and OM published their annual Cybercrimebeeld report on September 3, warning of a rising cohort of young, Western hackers. "These are individuals between 11 and 25 years old," said Stan Duijf, the police's cybercrime lead. "They come mainly from Western countries, speak English, operate in a loose online network, and mainly commit data and crypto theft."

Unlike earlier waves of cybercriminals who often operated from non-Western countries like Russia, this new generation is motivated by money and status, not ideology. The report cites the Odido hack earlier this year, where ShinyHunters stole personal data of 6 million customers and demanded a ransom. Odido refused to pay, and the data was put up for sale online. Police suspect Dutch nationals were involved.

Duijf noted that the lure into cybercrime often starts on gaming platforms like Roblox, Fortnite, or Minecraft. "They chat with others and are seduced. It starts with mischief, but they can grow into cybercriminals." An estimated 2.5 million people in the Netherlands fell victim to cybercrime in 2025. Source: NOS

What this means for the Dutch tech and security community

For engineers and security professionals, these cases highlight several practical concerns:

• Deepfake detection remains a cat-and-mouse game. The 74-year-old's case shows that even non-technical offenders can produce convincing fakes at scale. The OM's decision not to pursue the Canadian platform operator also underscores jurisdictional gaps.
• Physical security of IoT devices matters. The Flock breach demonstrates that encryption keys stored on-device are vulnerable to physical attack. Any system relying on "on-device encryption" should assume that a motivated attacker with physical access can extract keys.
• The rise of young, Western cybercriminals changes threat modeling. The old assumption that serious cybercrime originates from non-Western jurisdictions no longer holds. Dutch companies and institutions should expect attacks from actors who may be local, speak Dutch, and understand the legal landscape.

These developments are not isolated. They point to a broader trend: cybercrime is becoming more accessible, more diverse in its methods, and harder to police across borders.